> The point though is that if password changes are required, even with a long expiration time, people are only going to make minor and probably predictable changes to their password.

More significantly, if changes are required or weird composition rules used, people are more likely to store their password in a convenient unprotected form (historically, often paper kept next to their main computer, which is a risk, but these days the convenient form may itself by subject to remote compromise, making an even bigger risk.)